fix(google-workspace-admin): fail the ChromeOS batch when a device does not change

batchChangeStatus returns HTTP 200 for the batch as a whole and reports each
device separately, so a device that stayed enabled is only visible through its
per-result error. The tool returned success unconditionally, which meant an
offboarding agent would carry on believing a Chromebook had been disabled or
deprovisioned when it had not.

The transform now partitions the results and fails the tool when any device
errored, naming each failing device and Google's reason. Both sides of the
split are also exposed as succeededDeviceIds and failedDeviceIds so a partial
failure can be retried for just the remainder instead of re-running the whole
batch — which matters for DEPROVISION, where a repeat on an already-deprovisioned
device is not harmless.

Author: waleedlatif1

apps/docs/content/docs/en/integrations/google_workspace_admin.mdx

@@ -790,6 +790,8 @@ Deprovision, disable, or re-enable up to 50 ChromeOS devices at once. Deprovisio
 |   ↳ `deviceId` | string | Unique ID of the ChromeOS device |
 |   ↳ `response` | json | Present when the device changed status successfully |
 |   ↳ `error` | json | Present when the device failed to change status, with code, message, and details |
+| `succeededDeviceIds` | array | IDs of the devices that did change status, so a partial failure can be retried for the rest |
+| `failedDeviceIds` | array | IDs of the devices that did not change status |
 
 ### Google Workspace Admin List Activities
 

apps/sim/blocks/blocks/google_workspace_admin.ts

@@ -1283,6 +1283,14 @@ Return ONLY the query string - no explanations, no quotes, no extra text.`,
       type: 'json',
       description: 'Per-device status change results ([{deviceId, response, error}])',
     },
+    succeededDeviceIds: {
+      type: 'json',
+      description: 'IDs of the ChromeOS devices that did change status ([deviceId])',
+    },
+    failedDeviceIds: {
+      type: 'json',
+      description: 'IDs of the ChromeOS devices that did not change status ([deviceId])',
+    },
     activities: { type: 'json', description: 'Array of audit Activity resources' },
     usageReports: { type: 'json', description: 'Array of UsageReport resources' },
     warnings: { type: 'json', description: 'Warnings returned alongside a usage report' },

apps/sim/tools/generated/tool-outputs.ts

@@ -11,8 +11,19 @@ import {
 } from '@/tools/google_workspace_admin/utils'
 import type { ToolConfig } from '@/tools/types'
 
+/**
+ * A per-device outcome. The Admin SDK returns HTTP 200 for the batch as a whole
+ * and reports each device individually, so a device that stayed enabled is only
+ * visible through its `error`.
+ */
+interface ChangeChromeOsDeviceStatusResult {
+  deviceId?: string
+  response?: unknown
+  error?: { code?: number; message?: string; details?: unknown[] }
+}
+
 interface BatchChangeChromeOsDeviceStatusApiResponse {
-  changeChromeOsDeviceStatusResults?: unknown[]
+  changeChromeOsDeviceStatusResults?: ChangeChromeOsDeviceStatusResult[]
 }
 
 /**
@@ -101,10 +112,36 @@ export const batchChangeChromeOsDeviceStatusTool: ToolConfig<
       response,
       'Failed to change ChromeOS device status'
     )
+    const results = data.changeChromeOsDeviceStatusResults ?? []
+    const failed = results.filter((result) => result.error !== undefined)
+    const succeededDeviceIds = results
+      .filter((result) => result.error === undefined)
+      .map((result) => result.deviceId ?? '')
+      .filter((deviceId) => deviceId.length > 0)
+
+    if (failed.length > 0) {
+      return {
+        success: false,
+        error: `${failed.length} of ${results.length} ChromeOS devices failed to change status: ${failed
+          .map(
+            (result) =>
+              `${result.deviceId ?? 'unknown device'} (${result.error?.message ?? 'no reason given'})`
+          )
+          .join('; ')}`,
+        output: {
+          changeChromeOsDeviceStatusResults: results,
+          succeededDeviceIds,
+          failedDeviceIds: failed.map((result) => result.deviceId ?? '').filter(Boolean),
+        },
+      }
+    }
+
     return {
       success: true,
       output: {
-        changeChromeOsDeviceStatusResults: data.changeChromeOsDeviceStatusResults ?? [],
+        changeChromeOsDeviceStatusResults: results,
+        succeededDeviceIds,
+        failedDeviceIds: [],
       },
     }
   },
@@ -132,5 +169,16 @@ export const batchChangeChromeOsDeviceStatusTool: ToolConfig<
         },
       },
     },
+    succeededDeviceIds: {
+      type: 'array',
+      description:
+        'IDs of the devices that did change status, so a partial failure can be retried for the rest',
+      items: { type: 'string' },
+    },
+    failedDeviceIds: {
+      type: 'array',
+      description: 'IDs of the devices that did not change status',
+      items: { type: 'string' },
+    },
   },
 }